Mailchimp MC4WP Vulnerable to Reflected Cross-Site Scripting
CVE-2024-8850
6.1MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 19 September 2024
What is CVE-2024-8850?
The Mailchimp for WordPress plugin has a vulnerability that allows for Reflected Cross-Site Scripting through the misuse of the 'email' parameter. When placeholders like {email} are utilized, inadequate input sanitization and output escaping become apparent. This flaw enables attackers without authentication to inject malicious web scripts into pages. A successful exploitation requires the attacker to deceive a user into performing an action such as clicking a link, which triggers the execution of the injected script, posing significant risks to user data and website integrity.
Affected Version(s)
MC4WP: Mailchimp for WordPress 4.9.9 <= 4.9.16